I have installed OMSA with Windows 2k8 Enterprise R2 one of our blade Poweredge M710 server and discovered and inventoried in OME 1.1 successfully with SNMP and WMI authentication details but after one each hour i'm getting one critical alert (Category Security) in Alert by Severity list that Authentication Failure.
A: An authentication trap is sent when the SNMP agent is hit with an inquiry with a community name it does not recognize. These are case-sensitive also.
The traps are useful to know if someone is probing your system, although its better nowadays to just sniff packets and find out the community name that way.
If you use multiple community names on the network, and some management might overlap, people may want to turn these off as they become false positives (annoyances).
Send Authentication Traps. When an SNMP agent receives a request that does not contain a valid community name or the host that is sending the message is not on the list of acceptable hosts, the agent can send an authentication trap message to one or more trap destinations (management systems). The trap message indicates that the SNMP request failed authentication. This is a default setting.
Thanks very much, but i didn't get your answer can you please elaborate by the procedure..
Actually while adding this server it was OK my community name WMI credentials everything is fine but why it getting authentication failed error after 1/2/3 days and once it started the error coming after each one hour and earlier i was getting only for one server but one more server also start to throw the same alert, after 5 days from adding this server in OME.
Yeah, so I think this is just the common authentication error. The FAQ entry shows you how to uncheck that box on the managed node so you won't get them any more.
Try that procedure and see if it helps. There are a few other threads on 'authentication alerts'. You may search and see if there are other ways to address.
I'm trying to understand this, as the faq you referenced is just general-knowledge and the I don't think the issue is very clear.
I think what you are saying is that the "authentication error" alerts are cause by the managed server being configured to send an authentication trap to the OME server when it receives an unknown SNMP request. This can be resolved by removing the OME server from the authentication trap (just the "trap" not all of SNMP, you still need the OME server in the list of hosts).
DELL-Raj S
327 Posts
3739
0
Posted February 7th, 2013 11:00
en.community.dell.com/.../3265.openmanage-essentials-faq.aspx
Refer to Q 10.2. Here is a snippet:
10.2 Q: What are SNMP “authentication traps”?
A: An authentication trap is sent when the SNMP agent is hit with an inquiry with a community name it does not recognize. These are case-sensitive also.
The traps are useful to know if someone is probing your system, although its better nowadays to just sniff packets and find out the community name that way.
If you use multiple community names on the network, and some management might overlap, people may want to turn these off as they become false positives (annoyances).
From MS (technet.microsoft.com/.../cc959663.aspx):
Send Authentication Traps. When an SNMP agent receives a request that does not contain a valid community name or the host that is sending the message is not on the list of acceptable hosts, the agent can send an authentication trap message to one or more trap destinations (management systems). The trap message indicates that the SNMP request failed authentication. This is a default setting.
Thanks,
Raj Shresta